10 cursuri de care are nevoie fiecare CISO pentru a conduce securitatea, inteligența artificială și răspunsul la incidente

Ultima revizuire la 4 noiembrie 2026, comparativ cu sursele la care se face trimitere în această postare.

The board meets on Thursday, and the chair has one question for the CISO: "If we were hit by ransomware tomorrow, who decides what, and have we practised it?" The tools matter, but the answer depends on governance, drills and staff who report fast. That is what cyber security training for executives has to cover. NIST made the point in its Cybersecurity Framework 2.0, which added a sixth function, Govern, covering roles, responsibilities and authorities, policy and the oversight of cybersecurity strategy.

This list gives a CISO the courses to run that programme. You get 10 ready-made courses in 3 groups, what each fixes and how to roll them out. Each group ends with an Alegerea noastrăPunctele juridice descriu regulile federale ale SUA, așadar folosiți-le ca pe o programă, nu ca pe o hotărâre.

Toate cele 10 cursuri dintr-o privire

Două cursuri se bazează pe o regulă federală a SUA și sunt valabile doar pentru anumite organizații. Conform regulii NISPOM, contractorii de apărare autorizați trebuie să le ofere angajaților recent autorizați instruire privind conștientizarea amenințărilor interne înainte de acordarea accesului la informații clasificate și validează finalizarea inițială și anuală. Regulamentul FTC privind garanțiile prevede că instituțiile financiare vizate trebuie să furnizeze instruire privind conștientizarea securității pentru personalul lorNiciunul nu stabilește un curs pentru toți ceilalți.

Governance and frameworks

Guvernanța riscului cibernetic pentru manageri și consilii de administrație

This 40-minute course treats cyber risk as business risk. It covers five questions to ask about your organisation, risk appetite and a short dashboard, the grey areas of paying, telling and trade-offs, where duties come from, and the leadership actions to take next. A CISO can run it with the leadership team before a board cycle. The "a dashboard shows hundreds of measures" question works as a Pick Answer slide and starts the right argument. Board members get their own list in our board of directors training guide.

Folosește acest șablon

Guvernanță IT, arhitectură de întreprindere și cadre de audit IT: COBIT și TOGAF

This 45-minute course opens with "a system nobody was accountable for", then covers why IT governance matters for value, risk and resources, governance versus management objectives, the architecture development method, maturity models and planning an IT audit with a report to leadership. It gives IT managers who report to the CISO a shared frame. The "governance or management?" sorting activity makes a quick Pick Answer round.

Folosește acest șablon

ISO/IEC 27001 și sistemul de management al securității informațiilor

The CISO usually owns the ISMS, and every employee is part of it. This 40-minute course explains what an ISMS is, how policy becomes practice, how exceptions and weaknesses are handled and how to talk to an auditor. Roll it out before a certification or surveillance audit so staff can answer questions with evidence. An Open Ended slide on "what would you show an auditor?" surfaces the gaps early.

Folosește acest șablon

Alegerea noastră: Guvernanța riscului cibernetic pentru manageri și consilii de administrație. It turns NIST's Govern function into five questions a leadership team can answer, which is the conversation most CISOs need first.

Incident readiness and insider risk

Soluție ransomware pentru manageri

This 60-minute course is a tabletop in three parts: the first hour, decisions and communication, and backups and fixes. Managers practise who isolates machines, who speaks to the press and who decides about a ransom, which the course answers as leadership with legal advice. It ends with a 7-question final check. Run it live with the real names of your incident lead and communications head. For the analysts who carry out the plan, see lista noastră de training pentru analiști SOC.

Folosește acest șablon

Conștientizarea amenințărilor din interior

Insider threat programmes often sit with the CISO, from detection to response. This 30-minute course covers why detection matters, behavioural, technical and financial indicators, how adversaries recruit trusted insiders, what to do and not do, and where to report. It ends with a 10-question final check at 80% to pass. For cleared US contractors it is a ready-made way to deliver the training the NISPOM rule above requires, though the rule names no course.

Folosește acest șablon

Our pick: Ransomware tabletop for managers. A plan nobody has rehearsed fails in the first hour, and this tabletop makes leaders decide before the pressure is real.

Staff security habits and AI risk

Elemente esențiale de conștientizare a securității

This is the baseline awareness programme a CISO is accountable for. The 35-minute course covers why people are targeted, the anatomy of an attack, red flags, how to protect yourself and how to respond and report, with a 12-question final check at 80% to pass. For covered financial institutions it is a ready-made way to meet the FTC Safeguards Rule's security awareness training requirement, though the rule names no course.

Folosește acest șablon

Phishing și inginerie socială

Phishing resilience is a common CISO metric. This 30-minute course explains how attacks are built, the red flags, how to protect yourself and how to report, with a 12-question final check at 80% to pass. Pair it with your reporting button so the course and the metric match.

Folosește acest șablon

Parole, chei de acces și autentificare multi-factor pentru personal

Rolling out passkeys and MFA is a programme decision, and staff need to know why. This 30-minute course covers why accounts are the target, strong and unique sign-ins, multi-factor and passkeys, fake sign-in pages and the grey areas of sharing, shortcuts and recovery. Launch it the week a new sign-in method goes live.

Folosește acest șablon

Securitate AI pentru toți: AI în umbră, injecție promptă și ieșiri manipulate

AI security policy for shadow AI and prompt injection increasingly falls to the CISO. This 30-minute course covers shadow AI and a compromised chatbot, prompt injection and poisoned content, hidden instructions in PDFs and emails, free AI extensions and how to request an approved tool or report an incident. A Word Cloud on "which AI tools do you use at work?" shows the shadow AI you did not know about.

Folosește acest șablon

Inginerie socială, fraudă și deepfake-uri: escrocherii telefonice, cu plăți și prin uzurpare de identitate

Deepfake and impersonation fraud belongs in every executive threat briefing, because executives' names and voices are what attackers imitate. This 35-minute course follows a convincing request, covers the tactics, verifying payment changes, faked voice and video, and why seniority and secrecy are pressure, not proof. Run it with finance and the executive assistants first.

Folosește acest șablon

Alegerea noastră: Securitate bazată pe inteligență artificială pentru toată lumea. Staff often adopt AI tools faster than policy can follow, and this course gives them a simple request, use, check and report loop.

Cum se implementează planul

Start with governance. NIST's CSF 2.0 puts guverna first: executives set expectations on risk appetite, accountability and resources, and the rest of the programme follows from them.

1. This quarter, for leaders: cyber risk governance, then the ransomware tabletop with the people named in your incident plan.
2. For every employee, at onboarding: security awareness essentials, phishing, and passwords, passkeys and MFA.
3. For IT and security managers: COBIT and TOGAF, and ISO 27001 before your next audit.
4. În fiecare an: rerun the tabletop, a refresher quiz on each course, and the AI security course whenever a new AI tool is rolled out.
5. Când se aplică: cleared US defence contractors give insider threat training before access to classified information and every year after; covered financial institutions keep security awareness training current as the FTC Safeguards Rule describes. Ask your counsel what else applies in your country or state.

Modalități de desfășurare a acestor cursuri AhaSlides

Puteți construi oricare dintre acestea ca un curs în ritm propriu cu ajutorul AhaSlides course creator, run them as a live Q&A session deck, or both, with a post-course survey to see what changed.

1. Alegeți răspunsul: in the tabletop, show the ransom note and ask who decides the next step.
2. Cloud de cuvinte: ask leaders "What worries you most about a cyber incident?" and compare it with your risk register.
3. Scala de evaluare: before and after, ask "How ready is our incident plan?" from 1 to 5.
4. Deschis: collect anonymous questions for the board at the end of a live session.

FAQ

What training does a CISO need?

A CISO needs risk and governance, incident response leadership, knowledge of the rules that apply and the skill to brief a board. The courses above cover the programme a CISO runs; certifications cover the personal credential.

What certifications do CISOs have?

Common ones include CISSP, CISM and the EC-Council CCISO. None of the courses above is a certification.

How often should leaders run incident exercises?

At least once a year is a sensible baseline, and again after a major change such as a merger, a new system or a new incident lead.

What is a ransomware tabletop?

A ransomware tabletop is a discussion-based exercise that rehearses the decisions leaders make during a ransomware attack, without touching live systems.

Această postare conține informații generale, nu sfaturi juridice. Pentru o decizie privind locul de muncă, adresați-vă unui avocat calificat sau autorității de reglementare.